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OP 81-079 
1% January 1981 


MEMORANDOM FOR: Chief, “anagenent Staff, DDA 


PROMS Bruce T, Johnson 
Director of Data Processing 


SUBITNCT g nCI-Desiqnate Casey 3riefings 
REPREENCE + Maemo ee 13 Jan, 31, same 
subte 
be There are no activities in ODP which merit a place on 


the DDA's list of issues needing immediate BCI~level ettention, 
If far reasons of comprehensiveness some OLP itesn of interest 
are desired to round out an initial priefing on current 
Yirectocate activities, I would suqdgest SAFE, CANS2, and the 40 
{(Community-wide Computer-sassisted Compartmentation Control) 
Gystes, Of these only 4C is likely to come to Mr, Casey's 
attention as a problem, and only because of the sutetanding 
request ta Congress to lift the cap they put on AFEX 
expenditures for FY-8l., At urging, the DCI has 
askea far an additional $890,000 (atill well within the 
C_]buageted for APEX) to permit full develooment of the 
4c system, Attached are copies of the memoranda to the two 
Poancressional committees, touether with the stucy which outlines 
the consecuences of inadequate PY-81 funding. 


2, One other outstanding item which could conceivably he 
referred by the incoming Secretary of Commerce to the new uC is 
our request for a delegation of waiver authority under Pederal 
Information Processing Standards Publications 6°63. A capy of 
the recuest is attached. e understand that Comserce is 
consisering a general delegation to all heads of agencies, which 
would selve our problem, I do nat believe this needs to be 
discussed in the initial briefing, however. 


/s/ Bruce 7. Johnson 
Bruce T. Joknacn 
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ODP-0-1640, 
a NOV 1981 


Dr. Jordan J. Baruch 

Assistant Secretary for Productivity, 
Technology and Innovation 

Department of Commerce 

Washington, D. C. 20230 


Dear Dr. Baruch: 


For some time now, members of my staff have expressed 
serious concern about the security implications of waiver 
procedures for Federal Information Processing Standards (FIPS), 
where waiver authority does not reside with the Agency head. On 
7 October, CIA officials met with Mr. Don Malone of the Depart-— 
ment of Commerce, Office of the General Counsel to discuss FIPS 
waiver procedures. Mr. Malone reviewed the recently implemented 
waiver procedures for FIPS 60-63, where waiver authority has been 
assigned to the Secretary of Commerce, who, in turn, has 
delegated that authority to you. As Mr. Malone described the 
waiver procedure, individuals from your staff as well as the 
National Bureau of Standards will review FIPS waiver applications 
and make recommendations for approval or disapproval of the 
waiver request. As described in the FIPS PUBS, the waiver 
request must include "I) a description of the existing or planned 
ADP system for which the waiver is being requested, 2) a des- 
cription of the system configuration, identifying those items for 
which the waiver is being requested, and including a description 
of planned expansion of the system configuration at any time 
during its life cycle, and 3) a justification for the waiver, 
including a description and discussion of the major adverse 
economic or operational impact that would result through 
conformance to this standard as compared to the alternative 
for which the waiver is requested." 


Such a waiver request procedure and the documentation it 
requires are cause for considerable security concern to senior 
CIA management. Under the statutory provisions of the National 
Security Act of 1947, as amended, the DCI is charged with the 
responsibility for protecting intelligence sources and methods. 
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Relating this to current and anticipated ADPE acquisitions, it is 
our considered judgment that disclosure through the waiver pro- 
cess of the Agency‘s capabilities and location of its resources 
would not only adversely affect the proper discharge of this 
responsibility but would also, in some cases, represent a grave 
threat to national security. Our ADPE, whether general purpose 
or unique to our requirements, is utilized for extremely 
sensitive intelligence information processing, communications, 
and real-time intelligence-operation requirements. The type and 
location of equipment represent for foreign intelligence agencies 
prime targets in terms of operational utilization, equipment 
capabilities, or the readability of signal emanations. Of egual 
signficance is the fact that, in certain instances, identifica- 
tion with the Agency of specific equipment or sites of operations 
could be extremely embarrassing to the United States or to 
friendly foreign governments. 


For these reasons it is my firm opinion that a delegation of 
waiver authority to the Director of Central Intelligence with 
appropriate redelegation authority would best protect the 
national security interests involved in the acquisition and use 
of ADPE by the Central Intelligence Agency for intelligence 
information processing, communications, and intelligence 
operational applications. To assist in the discharge of your 
responsibilities related to ADPE standards, I would propose that 
on an annual basis representatives from our respective agencies 
meet to review, on a classified basis, CIA implementation of 
waiver procedures. In addition, we would be pleased to exchange 
or provide such technical advice in the ADP field as you may 
wish. 


A similar procedure has been in effect for several years 
between CIA and the General Services Administration (GSA) with 
respect to the procurement of ADP equipment and services. GSA 
has provided CIA a blanket delegation of procurement authority 
subject to annual GSA review. GSA has conducted several such 
reviews and has expressed satisfaction that we have appropriately 
implemented ADP procurement policy and regulations. ‘ 
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I would be pleased to make available the appropriate 
members of my staff to develop in conjunction with your 
representatives a suitable delegation of waiver authority. 
Please feel free to call Mr. Bruce Johnson, my Director of Data 
Processing, to answer any technical or procedural questions 
you or your staff may have. Mr. Johnson may be reached on 


25X11. 
Your favorable consideration of our request would be most 
appreciated. 
Sincerely, 
feo of 
Don I. Wortman 
Deputy Director 
for 
Administration 
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